1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638

Analysis

max time kernel
155s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 17:40

Target

1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638.exe
Size

79KB
MD5

1db7182c4ff8bd9ab81bf1b867650eef
SHA1

a7986dec4b8a9f183c4eea1ce4a1518e36fe6ced
SHA256

1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638
SHA512

895bd25802cd8ecb22f96ec5149cbbb1d06f495ca10b253aa4376c0b96a4aecafe19f1250d796d5602ee400c396546b67bd346c86d7e58df5792b2cb4fbdcc2e
SSDEEP

1536:zv5cWytItg2ofHVNz8rsOQA8AkqUhMb2nuy5wgIP0CSJ+5yvB8GMGlZ5G:zvWeu2vGdqU7uy5w9WMyvN5G

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
1668	[email protected]

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4664	4508	1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638.exe	95
PID 4508 wrote to memory of 4664	4508	1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638.exe	95
PID 4508 wrote to memory of 4664	4508	1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638.exe	95
PID 4664 wrote to memory of 1668	4664	cmd.exe	96
PID 4664 wrote to memory of 1668	4664	cmd.exe	96
PID 4664 wrote to memory of 1668	4664	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638.exe
"C:\Users\Admin\AppData\Local\Temp\1172b8dfbed84923e5665492e1d6618b948fe64592a5a03bbf37ae497435c638.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c [email protected]
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Admin\AppData\Local\Temp\[email protected]
    [email protected]
    3⤵
    - Executes dropped EXE
    PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4172 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:3588

C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
79KB

MD5
18ec49c117e44d7d07c9a8fcccef0c7d

SHA1
7728d2b100eec4e66444a4d783651d9e24da9bc1

SHA256
ed9385dd0c71d17ee2b6c4c284532282a5e3ffe0527f5117479865344451d59d

SHA512
8ed7863bde1dc2117d45d115fc5e939ebefa79d26dccc9ec5e25c9f12216e6cf170dea42c83627e2ab665bbd509ec8087b3a2ed16e8e7b27bc23c2102cf7334b

Download Submit
memory/1668-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4508-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download